[Oisf-users] Suricata with PF_RING on latest git

[Martin Holste]

> I'm running:
> PF_RING Version     : 5.4.3 ($Revision: 5441$)
> Transparent mode    : Yes (mode 0)
>
> with a couple of different applications with different BPF filters
> that are built with PF_RING and another application that isn't - and
> they all seem to be happily seeing different subsets of traffic.

Hm, maybe a change from 5.1 to 5.4 then.  Do you have one app that is
using PF_RING clustering?  I have one cluster ring and several
non-clustered apps.  For the non-clustered, they have to use the same
BPF.